@noob-stupid/dsh-plugin-console 0.3.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 dsh-plugin-console contributors
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,446 @@
1
+ > **English**: [README.md](README.md) | **中文**: [README.zh.md](README.zh.md)
2
+
3
+ ---
4
+
5
+ <img width="1170" height="609" alt="image" src="https://github.com/user-attachments/assets/b802d606-14ba-4151-9956-ff642ed12b0a" />
6
+
7
+ # DSH Plugin Hub (dsh-plugin-hub)
8
+
9
+ [![](https://img.shields.io/badge/powered_by-dsh-4D6BFE?style=flat-square&logo=deepseek&logoColor=white)](https://github.com/deepseek-ai/deepseek-harness)
10
+ [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
11
+ [![GitHub stars](https://img.shields.io/github/stars/Noob-stupid/dsh-plugin-hub?style=flat-square&logo=github)](https://github.com/Noob-stupid/dsh-plugin-hub/stargazers)
12
+ [![License](https://img.shields.io/github/license/Noob-stupid/dsh-plugin-hub?style=flat-square)](LICENSE)
13
+ [![Last commit](https://img.shields.io/github/last-commit/Noob-stupid/dsh-plugin-hub?style=flat-square)](https://github.com/Noob-stupid/dsh-plugin-hub/commits/main)
14
+ [![Registry CI](https://img.shields.io/github/actions/workflow/status/Noob-stupid/dsh-plugin-hub/registry.yml?label=registry%20CI&style=flat-square)](https://github.com/Noob-stupid/dsh-plugin-hub/actions/workflows/registry.yml)
15
+ [![topic: dsh-plugin](https://img.shields.io/badge/topic-dsh_plugin-4D6BFE?style=flat-square)](https://github.com/topics/dsh-plugin)
16
+
17
+ A **plugin management panel** for the DeepSeek Harness (DSH) Web GUI: one-click
18
+ enable/disable of installed plugins, a **multi-source plugin marketplace**
19
+ (GitHub / Gitee / custom sources) with one-click install, an **auto-collected
20
+ static plugin & skill index** refreshed by CI every 6 hours, skill install/disable,
21
+ suite one-click assembly, and **one-click framework upgrade** (online install with
22
+ auto-rollback).
23
+ (GitHub / Gitee / custom sources) with one-click install — and an **auto-collected
24
+ static plugin & skill index** refreshed by CI every 6 hours.
25
+
26
+ <!-- TOC -->
27
+ - [Highlights](#highlights)
28
+ - [One-click install](#one-click-install)
29
+ - [Usage](#usage)
30
+ - [Features](#features)
31
+ - [How it works](#how-it-works)
32
+ - [Compatibility](#compatibility)
33
+ - [Project layout](#project-layout)
34
+ - [HTTP endpoints](#http-endpoints)
35
+ - [Local AI fallback & consent dialog](#local-ai-fallback--consent-dialog)
36
+ - [Framework patch (cordis.patch.yml parse tolerance)](#framework-patch-cordispatchyml-parse-tolerance)
37
+ - [Security](#security)
38
+ - [Disclaimer](#disclaimer)
39
+ - [Known limitations](#known-limitations)
40
+ - [Help](#help)
41
+ - [Ecosystem & discoverability](#ecosystem--discoverability)
42
+ - [Support](#support)
43
+ - [Changelog](#changelog)
44
+ - [License](#license)
45
+ <!-- /TOC -->
46
+
47
+ ---
48
+
49
+ ## Highlights
50
+
51
+ | | Benefit | Detail |
52
+ |---|---|---|
53
+ | 🧩 | **Plugin & skill hub** | Auto-collected index of `dsh-plugin` topic repos (**500+** by stars) plus a **Skills tab** (`agent-skills` ∪ `claude-skills` ∪ `dsh-skill`, up to 300) — browse, search, one-click install, no GitHub API calls |
54
+ | 🤖 | **Auto-collection CI** | GitHub Actions reruns `build-index` every 6 hours (manual trigger available); authors just add the `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` topic — no application needed |
55
+ | ⚡ | **Instant, rate-limit-free** | The index is served as a static `marketplace/index.json` via jsDelivr CDN (10-min host cache); terminal users make **zero GitHub API calls** |
56
+ | 🔄 | **Version detection & one-click update** | Installed entries are matched against npm `dist-tags.latest` automatically; cards show **「更新 → vX」**; subpackage mismatch warnings prevent mixed-version breakage |
57
+ | 🔀 | **Multi-source** | GitHub / Gitee (direct-repo mode) / custom search sources (URL template + header auth + private http); `⊞` merges GitHub + all custom sources in parallel |
58
+ | 🔒 | **Safe by default** | Loopback-only routes; AI fallback behind an explicit cost-consent modal; infrastructure rows are toggle-protected |
59
+
60
+ > **For plugin authors**: add the `dsh-plugin` topic to your repo — the official
61
+ > [topic list](https://github.com/topics/dsh-plugin) is how both the ecosystem and this
62
+ > hub discover you. For skills, add `agent-skills` / `claude-skills` / `dsh-skill`.
63
+
64
+ ---
65
+
66
+ ## One-click install
67
+
68
+ ### Option 1: official command (recommended)
69
+
70
+ The plugin declares a `dsh.bundle` manifest, so a single command installs and enables it:
71
+
72
+ ```sh
73
+ dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub
74
+ ```
75
+
76
+ Uninstall / reinstall (update):
77
+
78
+ ```sh
79
+ dsh plugin --profile web remove github:Noob-stupid/dsh-plugin-hub
80
+ dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub
81
+ ```
82
+
83
+ Then restart the dsh service → refresh the page → Settings → Plugins → Plugin Console.
84
+
85
+ ### Option 2: deploy script (fallback when network is restricted)
86
+
87
+ Windows (PowerShell):
88
+
89
+ ```powershell
90
+ git clone https://github.com/Noob-stupid/dsh-plugin-hub "$env:TEMP\dsh-plugin-console" 2>$null; & "$env:TEMP\dsh-plugin-console\deploy.ps1"
91
+ ```
92
+
93
+ Linux / macOS:
94
+
95
+ ```bash
96
+ git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console 2>/dev/null; bash /tmp/dsh-plugin-console/deploy.sh
97
+ ```
98
+
99
+ The script copies the plugin into `$DSH_HOME/profiles/<profile>/node_modules/` and
100
+ idempotently appends an enable entry to `cordis.patch.yml`. Afterwards:
101
+
102
+ 1. Restart the dsh service (host code changes need a process restart; CLI restarts the
103
+ process, the desktop client exits and reopens);
104
+ 2. Refresh the page → Settings → Plugins → **Plugin Console**.
105
+
106
+ ### Option 3: hand it to an AI in one sentence
107
+
108
+ > Install the DSH plugin hub (dsh-plugin-hub): run `dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub`; if there is no dsh CLI, clone https://github.com/Noob-stupid/dsh-plugin-hub to `~/.dsh/profiles/web/node_modules/` and register it in `cordis.patch.yml` (id: plugin-console, name: @deepseek-ai/dsh-plugin-console). Restart dsh web afterwards.
109
+
110
+ Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host-plugin-inventory`).
111
+
112
+ ---
113
+
114
+ ## Usage
115
+
116
+ 1. Restart DSH → open the Web GUI → **Settings → Plugins → Plugin Console**.
117
+ 2. **Installed list**: toggle plugins on/off (HMR applies within ~1s), search by name/id,
118
+ expand details (version, repository, README summary).
119
+ 3. **Marketplace**: empty query on the GitHub source opens the static index (instant);
120
+ type a query to search live. Switch sources via the login pill (GitHub / Gitee / custom);
121
+ `⊞` merges all sources; `★` filters to `dsh plugin add`-installable packages.
122
+ 4. **Skills tab**: switch 插件/技能 next to the search box to browse and install skills
123
+ (cloned into `~/.dsh/skills/<name>/`).
124
+ 5. **Install**: click 添加到本地 → the chain runs in the background (safe to leave the page);
125
+ 「检测更新」/「更新 → vX」 appear automatically for installed entries.
126
+
127
+ ---
128
+
129
+ ## Features
130
+
131
+ ### Installed plugins (one-click toggle + details)
132
+
133
+ - **Shows only third-party plugins by default** (extra/non-bundled), tagged
134
+ "Third-party" with a delete entry; click "All" to see the full list (1.5s flash feedback);
135
+ - Lists every plugin entry (name, load state, enabled state); search by name/id;
136
+ - Disable = append `- id: X` + `disabled: true` to the user patch layer, effective via HMR;
137
+ - Enable = remove that entry; bundle-layer rows disabled by default are overridden with
138
+ `disabled: false`;
139
+ - Tags "Patch-disabled / Patch-forced" distinguish user patch state;
140
+ - **Infrastructure protection**: host transport/hmr/storage/settings chain plugins
141
+ (70+ rows) are marked "Protected" and cannot be toggled — disabling them would break HMR;
142
+ - **Details panel**: version, repository/homepage links and a README summary for each plugin;
143
+ - **Version check**: 检测更新 reads npm `dist-tags.latest` (curl channel, works even when
144
+ node networking is blocked) and warns about subpackages that need syncing (depsOutdated).
145
+
146
+ ### Framework one-click upgrade (deepseek-harness card)
147
+
148
+ - The **deepseek-harness** card shows **「框架升级 → vX」** when a newer framework version is
149
+ available (stable `latest` preferred; `next` channel when `latest` equals the installed
150
+ version); clicking runs the full flow: backup config + framework snapshot (rollback point)
151
+ → **online install** (service stays up, page never disconnects) → version verification →
152
+ **auto-restart to apply**;
153
+ - **Real-time progress**: a `DSH-Upgrade` console window pops up showing live pnpm download
154
+ progress; the in-panel progress card shows the waiting time;
155
+ - **Upgrade protection**: failed installs **auto-rollback** (robocopy, backup verified before
156
+ upgrade), version check catches fake success, 10-min hard timeout, stall detection
157
+ (no debug-log updates → auto switch registry), global trap fallback, and 15-min stale-state
158
+ cleanup — the framework is never left broken;
159
+ - **pnpm channel**: npm-cli.js freezes at startup in the schtasks task environment (0-byte
160
+ debug log, no network requests ever sent); upgrades use `corepack pnpm` (starts in ~0.4s,
161
+ installed rc.8 in 11.5s) against the **npmmirror (China) registry**, with
162
+ `dangerouslyAllowAllBuilds` so native modules (node-pty/koffi) compile;
163
+ - **Runtime bin resolution**: under the pnpm layout `@deepseek-ai/dsh` is a Junction — the
164
+ relaunch step resolves `bin.js` at runtime (follows the Junction to the current version)
165
+ instead of using a path baked in at script-generation time;
166
+ - **Card dismiss semantics**: terminal states (done/failed) are permanently dismissed on ✕
167
+ (persisted); in-progress dismissal is session-only and the card returns after a refresh.
168
+
169
+ ### Marketplace (multi-source)
170
+
171
+ - **Source switcher**: click the login pill to switch between **GitHub / Gitee / custom
172
+ sources** (persisted); title, loading text, placeholder and note all follow the source;
173
+ - **GitHub**: default query `dsh-plugin`, browser-direct with server fallback;
174
+ - **Gitee**: official search API is retired, so it uses **direct-repo mode** — enter
175
+ `owner/repo` (Chinese paths and full URLs supported) to find and install a repository;
176
+ - **Custom sources**: add in Source Manager (URL template with `{q}`/`{page}` placeholders),
177
+ optional **header auth** (e.g. `Authorization: Bearer ...`), and **local/private http URLs**;
178
+ - **Multi-source summary**: the `⊞` toggle searches GitHub + all custom sources in parallel,
179
+ merging results with source labels;
180
+ - **★ official filter**: shows only packages installable via `dsh plugin add` — root packages
181
+ with a `dsh.bundle` manifest (official) or aggregate repos whose **subpackage carries
182
+ `dsh.bundle`** (subpackage-installable); markers are enriched by the server (curl dual-channel)
183
+ with a client-side fallback;
184
+ - **Type badges**: 官方 / 聚合 / 技能 (repo contains SKILL.md) recognized automatically.
185
+
186
+ ### Static index market (plugin & skill tabs)
187
+
188
+ > **Hybrid architecture**: browsing uses the static index (instant, zero GitHub API calls),
189
+ > searching uses live channels (GitHub search API / multi-source parallel) — they complement
190
+ > each other: a brand-new repo can be found by live search even before it enters the index.
191
+
192
+ - Empty query on the GitHub source shows the **static index** (`marketplace/index.json`,
193
+ jsDelivr CDN + 10-min host cache): 500+ plugins by stars, instant, **zero GitHub API calls**;
194
+ - **插件 / 技能 tabs** next to the search box: the skills tab lists auto-collected
195
+ `agent-skills` ∪ `claude-skills` ∪ `dsh-skill` repos (up to 300);
196
+ - **Auto version check**: installed entries in the market are checked against npm
197
+ `dist-tags.latest` in the background — cards turn into **「更新 → vX」** buttons;
198
+ - **Skill install**: skill entries install by git-clone into `~/.dsh/skills/<name>/`
199
+ (frontmatter `name` wins over repo name; SKILL.md found at repo root or first-level
200
+ subdirectory). Installed skills show a grey 「已装」 badge.
201
+
202
+ ### Source Manager
203
+
204
+ The floating "Sources" button (right of the title row, semi-transparent) opens the manager:
205
+
206
+ ![Source Manager](https://github.com/user-attachments/assets/ef712900-65ae-4f6f-9584-bacdd8d34ea1)
207
+
208
+ - **Install sources (registry)**: add / inline edit / set primary / restore defaults;
209
+ private and intranet addresses supported; **deletion is protected** (install-critical);
210
+ - **Search sources**: built-in GitHub, Gitee + custom search sources (add/remove, `🔒` shows
211
+ header count);
212
+ - **Gitee login (optional)**: direct mode needs no login; login only raises rate limits —
213
+ create a third-party app (gitee.com → Data management → Third-party apps, scopes
214
+ user_info, projects), fill client_id / client_secret, save, then authorize.
215
+
216
+ ---
217
+
218
+ ## How it works
219
+
220
+ ### Toggle semantics
221
+
222
+ The DSH web profile is composed of a bundle patch layer plus the user patch layer
223
+ (`$DSH_HOME/profiles/web/cordis.patch.yml`); patches are **per-key overrides**.
224
+ Toggling a plugin just appends/removes two YAML lines:
225
+
226
+ ```yaml
227
+ - id: plugin-entry-id
228
+ disabled: true
229
+ ```
230
+
231
+ The config watcher (HMR) recomposes within ~1s — no restart needed except for host code.
232
+
233
+ ### Install chain
234
+
235
+ ```
236
+ configured registries (primary→backup, default npmmirror → npmjs)
237
+ → curl manual install (node networking blocked: tarball into node_modules)
238
+ → git channel (GitHub via proxy+direct, Gitee via its platform)
239
+ → EPERM stale-dir cleanup retry
240
+ → repository subpackage expansion (aggregate packages first)
241
+ → local AI fallback (behind an explicit cost-consent modal)
242
+ ```
243
+
244
+ Skills install directly by `git clone --depth 1` → copy SKILL.md bundle into
245
+ `~/.dsh/skills/<name>/` (no npm, no patch, no restart).
246
+
247
+ ### Data sources
248
+
249
+ ```
250
+ GitHub Actions (every 6h, repo token)
251
+ └─ scripts/build-index.cjs: pages topic:dsh-plugin (500 by stars) + skills topics (300)
252
+ └─ commits marketplace/index.json back to main
253
+ └─ host reads it via jsDelivr CDN (10-min cache) → instant market, zero API calls
254
+ └─ live search still uses the GitHub search API (browser-direct + server channel)
255
+ ```
256
+
257
+ ### Version detection & installed recognition
258
+
259
+ - **Installed recognition**: match installed entries by `repository` field or module name
260
+ against market items (repo name → package name mapping);
261
+ - **Version detection**: `check-update` reads npm `dist-tags.latest` via curl; for aggregate
262
+ packages it also compares subpackage declared vs actual versions (depsOutdated) to prevent
263
+ mixed-version startup conflicts.
264
+
265
+ ---
266
+
267
+ ## Compatibility
268
+
269
+ - Supports the **DSH 0.1.0 series** (`0.1.0-rc.6` and siblings).
270
+ - The panel reads the running `@deepseek-ai/dsh-web-app` version: after a breaking upgrade
271
+ (0.2 / 1.0) a compatibility warning appears instead of silent failure.
272
+ - Likely breaking seams: patch semantics, `webServer.register`, loader entry shape,
273
+ `dsh.client` bundle format, `settings.plugins.tab` slot.
274
+ - Deploy scripts do not check versions; the in-panel warning is authoritative.
275
+
276
+ ---
277
+
278
+ ## Project layout
279
+
280
+ ```
281
+ lib/index.js Host plugin (/plugin-console/* routes + patch I/O + multi-source search + install)
282
+ lib/client.js Browser bundle (ModuleLoader format, settings tab)
283
+ scripts/build-index.cjs Index builder (plugins --limit 500 / skills --skills --limit 300)
284
+ scripts/apply-framework-patch.cjs Framework patch (issue #5, idempotent)
285
+ .github/workflows/registry.yml Auto-collection CI (every 6h + manual dispatch)
286
+ marketplace/index.json Generated static index (jsDelivr CDN)
287
+ deploy.ps1 / deploy.sh One-click deploy scripts (Windows / Linux·macOS)
288
+ test-harness.mjs Logic self-test (state/toggle/validation/loopback; search SKIP by network)
289
+ ```
290
+ <img width="1878" height="945" alt="image" src="https://github.com/user-attachments/assets/b26f2f19-0ba4-4be7-9ca1-b3fd4c51a7a8" />
291
+
292
+ ---
293
+
294
+ ## HTTP endpoints
295
+
296
+ | Endpoint | Method | Purpose |
297
+ |---|---|---|
298
+ | `/plugin-console/state` | GET | Plugin list + patch state + compat + running install jobs |
299
+ | `/plugin-console/toggle` | POST | Enable/disable an entry (writes user patch layer) |
300
+ | `/plugin-console/uninstall` | POST | Remove entry + uninstall package (bundle-aware) |
301
+ | `/plugin-console/search` | POST | Multi-source search (github/gitee/custom, `multi` merge) |
302
+ | `/plugin-console/repo` | POST | Repo metadata: package.json, private root, dsh hint, **hasSkill** |
303
+ | `/plugin-console/enrich` | POST | Server-side type markers (official/aggregate/skill) |
304
+ | `/plugin-console/install` | POST | Install (plugin or `kind: skill`), returns a job id |
305
+ | `/plugin-console/install-status` | POST | Poll an install job |
306
+ | `/plugin-console/check-update` | POST | npm latest version + subpackage mismatch check |
307
+ | `/plugin-console/market-index` | POST | Static index (jsDelivr CDN, 10-min cache) |
308
+ | `/plugin-console/skills-installed` | GET | Installed skills under `~/.dsh/skills` |
309
+ | `/plugin-console/sources` | GET/POST | Registry & search-source manager, Gitee OAuth setup |
310
+ | `/plugin-console/gitee-oauth-url` / `gitee-oauth-callback` | GET | Gitee OAuth flow |
311
+ | `/plugin-console/ai-consent` | POST | Approve/cancel the AI-fallback step |
312
+ | `/plugin-console/restart` | POST | Watchdog-safe self-restart (panel button equivalent) |
313
+
314
+ ---
315
+
316
+ ## Local AI fallback & consent dialog
317
+
318
+ Installation goes through a **deterministic channel chain**:
319
+ `configured sources (primary→backup) → curl manual install → git channel → EPERM cleanup retry
320
+ → repository subpackage expansion`. Only when all deterministic channels fail does the
321
+ **local AI fallback** take over.
322
+
323
+ **What it is**: a local AI subagent takes over the install — it diagnoses like a human
324
+ (inspects repo structure, finds subpackages/aggregate packages, cleans leftovers), installs
325
+ with the right package manager and writes the config. **Note: this step calls a DeepSeek API
326
+ model and may incur API costs.**
327
+
328
+ **Consent dialog (cost transparency)**:
329
+
330
+ 1. After all deterministic channels fail, the task enters "waiting for authorization" and a
331
+ top-most modal appears:
332
+ - explicitly states "will call a DeepSeek API model, may incur API costs"
333
+ - offers **Approve, continue** / **Cancel** (Cancel = zero cost)
334
+ - auto-cancels after 10 minutes
335
+ 2. The modal offers **"Don't ask again"** (auto-approve) — restorable at the bottom of the
336
+ marketplace page.
337
+ 3. The floating **"AI fallback"** toggle can disable the feature entirely: deterministic
338
+ failures cancel the install, **never calling a model API (zero cost)**.
339
+
340
+ ---
341
+
342
+ ## Framework patch (cordis.patch.yml parse tolerance)
343
+
344
+ **Problem (issue #5)**: if `cordis.patch.yml` contains a top-level `[]` placeholder plus
345
+ later entries (two YAML root nodes), DSH fails at startup:
346
+ `end of the stream or a document separator is expected`.
347
+
348
+ **Fix location**: `parsePatchList` in the DSH framework `dsh-app-boot` — on parse failure,
349
+ top-level empty-array placeholder lines are dropped (treated as no-op) and parsing retries;
350
+ normal files, pure `[]` files, and indented sub-arrays are unaffected.
351
+
352
+ **Apply** (re-run after every DSH upgrade, which overwrites framework files):
353
+
354
+ ```bash
355
+ node scripts/apply-framework-patch.cjs
356
+ ```
357
+
358
+ The script locates `dsh-app-boot/lib/index.js` in the npx cache, skips when already patched
359
+ (idempotent), and keeps a `.bak-issue5` backup on first apply.
360
+
361
+ ---
362
+
363
+ ## Security
364
+
365
+ - All routes are loopback-only;
366
+ - GitHub metadata is used only to discover public plugins; npm installs keep full TLS
367
+ validation against the registry;
368
+ - GitHub search is browser-direct; Gitee/custom source requests and headers (including
369
+ credentials) are handled server-side only and never shipped to the browser;
370
+ - Custom source URLs accept https and local/private http only (127.0.0.1, localhost,
371
+ 10.x, 192.168.x, 172.16-31.x, etc.);
372
+ - Skills are plain files (SKILL.md + assets) — installing a skill does **not** execute code;
373
+ the git clone comes from the repo you chose, review the repo before installing.
374
+
375
+ ---
376
+
377
+ ## Disclaimer
378
+
379
+ - The marketplace lists third-party repositories from GitHub; each plugin is developed and
380
+ maintained by its own author and has **no affiliation with DeepSeek Harness or this hub**.
381
+ - This hub makes **no warranty** about any plugin's quality, reliability, security, license
382
+ compliance or compatibility. Listing is **not an endorsement** — install means you have
383
+ reviewed and accepted the risk. Read the repo source and README before installing.
384
+ - This hub is provided AS-IS; neither the hub nor its developers are liable for any damage
385
+ (data loss, system damage, privacy leaks) caused by installing or using third-party plugins.
386
+
387
+ ---
388
+
389
+ ## Known limitations
390
+
391
+ - Host code changes require a **service restart** (the panel's restart button is
392
+ watchdog-safe); client changes just need a page refresh;
393
+ - Live GitHub search depends on GitHub reachability (browser-direct + server fallback;
394
+ during network-blackout windows retry later);
395
+ - Version detection works for npm-published packages; skill-type repos have no version concept;
396
+ - The static index is capped (500 plugins / 300 skills per build); authors bump their star
397
+ count or wait for the 6h CI cycle to enter the index;
398
+ - Skills are discovered by `dsh-skill-filesystem` — if the current profile does not enable
399
+ that plugin, installed skills stay dormant until it is enabled and DSH restarted.
400
+
401
+ ---
402
+
403
+ ## Help
404
+
405
+ - **Panel missing**: restart dsh → refresh → Settings → Plugins → Plugin Console.
406
+ - **Toggle does nothing**: infrastructure rows are "Protected" (by design); normal toggles
407
+ take effect via HMR within 1-3s.
408
+ - **Compatibility warning**: a breaking upstream release arrived; see Compatibility.
409
+ - **Search empty/fails**: GitHub uses browser-direct (falls back to the server channel);
410
+ Gitee is direct-repo mode (enter `owner/repo`); check custom-source URL/headers; retry
411
+ during network blackout windows.
412
+ - **★ filter empty**: ★ shows only `dsh plugin add`-installable packages (official +
413
+ subpackage-bundle aggregates); markers are backfilled in 1-3s — no false "none" report.
414
+ - **Install fails**: confirm the repo has package.json and the package is published; npm
415
+ failures fall back to git install; switch the primary source if npmmirror is unstable.
416
+ - **Skill not found by DSH**: enable `@deepseek-ai/dsh-skill-filesystem` in the profile
417
+ (`cordis.yml`) and restart; skills live in `~/.dsh/skills/<name>/`.
418
+
419
+ ---
420
+
421
+ ## Ecosystem & discoverability
422
+
423
+ - Listed on [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) (the community main list) and [DSH Directory](https://dsh.directory);
424
+ - This hub's own auto-collection index (500+ plugins / 300 skills, refreshed by CI every 6h) includes **any** repo tagged `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` — tag your repo and it appears in the market automatically, no application needed;
425
+ - If you build DSH plugins, this panel is your distribution channel: one-click install for every user of the hub.
426
+
427
+ ## Support
428
+
429
+ If this panel saves you time or makes DSH more fun to use:
430
+
431
+ - ⭐ **Star this repo** — it directly helps more DSH users find it;
432
+ - Share it with DSH users or in DSH communities;
433
+ - Submit your own plugin (tag it `dsh-plugin`) to grow the ecosystem;
434
+ - Found a bug or want a feature? [Open an issue](https://github.com/Noob-stupid/dsh-plugin-hub/issues).
435
+
436
+ ---
437
+
438
+ ## Changelog
439
+
440
+ See [CHANGELOG.md](CHANGELOG.md).
441
+
442
+ ---
443
+
444
+ ## License
445
+
446
+ MIT